fix(docker): model downloads failed in containers (curl exit 23, glibc mismatch)

- pin builder and runtime to the same Debian release (trixie): the floating
  rust:1-slim builder drifted to a newer glibc than the bookworm runtime, so
  freshly built images crashed on start with 'GLIBC_2.39 not found'
- install curl in the runtime image — ready-.cmf imports download with it
- keep all gateway state under /app/data (CORTIQ_GATEWAY_HOME) and run as
  root so bind-mounted host folders on Docker Desktop are writable; pass
  --user 10001 to harden when not bind-mounting
- persist /app/data via a cortiq-data volume in docker-compose
- fail imports immediately with the path and reason when the models dir
  cannot be created, and annotate curl exit codes 23/22 with readable hints
- exclude local models/*.cmf from the docker build context

docker-compose.yml

@@ -17,6 +17,10 @@ services:
       CORTIQ_ROUTER_KEY: ${CORTIQ_ROUTER_KEY:-}
     volumes:
       - ./config/gateway.compose.toml:/app/config/gateway.toml:ro
+      # downloaded .cmf models + stats persist here across recreates; swap the
+      # named volume for a host folder (e.g. ./models:/app/data/models) if you
+      # want the files visible next to the compose file
+      - cortiq-data:/app/data
     depends_on:
       - ollama
     restart: unless-stopped
@@ -30,4 +34,5 @@ services:
     restart: unless-stopped
 
 volumes:
+  cortiq-data:
   ollama: